Legal

Data Processing Agreement

How we handle the personal data of your customers, suppliers and staff when it is in SME360.

Last updated 12 October 2026 · Bleu Meridian Technologies, Lagos, Nigeria

In brief

For the details of your customers, suppliers and staff, your business is the controller and we are your processor.
We use that information only to run SME360 for you, keep it secure, and share it only with the providers listed in Annex 3.
If there is a breach, we tell you within 48 hours.
We help you answer the people it is about, and we delete it when you delete your business.

This summary is for convenience — the full text below is what applies.

1. Parties and scope

1.1This Data Processing Agreement ("DPA") is between Bleu Meridian Technologies (CAC registration no. 9017064), Lagos, Nigeria, which operates SME360 ("SME360", "we", "us"), and the business that holds an SME360 account ("you", "the Business").
1.2It applies to Customer Personal Data (defined below) that we process on your behalf when providing SME360. It does not cover data about you as an account holder, which we handle as a controller under our Privacy Policy.
1.3If this DPA conflicts with the Terms of Service on anything about personal data, this DPA prevails.
1.4This DPA applies automatically to every SME360 business account and forms part of our Terms of Service; you do not need to sign anything. If you need a signed copy for your own records, email info@sme360app.com.

2. Definitions

2.1Data Protection Law means the Nigeria Data Protection Act 2023 and the regulations and directives issued under it, and any other data protection law that applies to the processing.
2.2Customer Personal Data means personal data that you, or people you authorise, put into SME360 about other people — your customers, suppliers, staff, and anyone named in your records, documents, uploads or messages to the assistant.
2.3Controller, processor, data subject, personal data, processing and personal data breach have the meanings given in Data Protection Law.
2.4Sub-processor means a third party we engage that processes Customer Personal Data on our behalf.

3. Roles

3.1For Customer Personal Data, you are the controller and we are your processor.
3.2The details of the processing — its subject matter, duration, nature and purpose, and the types of data and people involved — are in Annex 1.

4. Your instructions

4.1We process Customer Personal Data only on your documented instructions. Your instructions are: this DPA, the Terms of Service, and the actions you and your authorised users take in SME360 (for example saving a customer, emailing an invoice, sharing a link, or asking the assistant a question).
4.2We will tell you if we believe an instruction breaks Data Protection Law, and we may decline to follow it.
4.3If the law requires us to process Customer Personal Data in another way, we will tell you before doing so, unless the law forbids that.
4.4We do not sell Customer Personal Data, use it for advertising, use it to train AI models, or use it for any purpose of our own other than running, securing, supporting and improving SME360 for you.

5. Your responsibilities

5.1You are responsible for having a lawful basis to collect the Customer Personal Data you put into SME360, and for telling the people it is about how you use it, as Data Protection Law requires.
5.2You are responsible for who you give access to your business in SME360 and what they are allowed to do, and for removing access when someone leaves.
5.3SME360 is a bookkeeping tool and is not designed for sensitive personal data (such as health, religious or biometric information). Please do not upload it unless you genuinely need to and have a lawful basis.

6. Confidentiality and our people

6.1Only SME360 team members who need access to run, secure or support the service can access Customer Personal Data. They are bound by confidentiality.
6.2Access to our internal tools is limited to named people, is separated by role, and is logged.

7. Security

7.1We take appropriate technical and organisational measures to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. The measures in place are described in Annex 2. We may improve them over time, but we will not reduce the overall level of protection.

8. Sub-processors

8.1You give us general authorisation to use the sub-processors listed in Annex 3.
8.2Before we add or replace a sub-processor, we will update Annex 3 and tell account owners in the app or by email at least 14 days in advance. If you object on reasonable data protection grounds, tell us within that time; if we cannot address the objection, you may stop using SME360 and delete your business, and this DPA ends.
8.3We bind each sub-processor to data protection obligations that are no less protective than this DPA, and we remain responsible to you for their performance of those obligations.

9. International transfers

9.1SME360's database and file storage are hosted in the United States, and some sub-processors operate outside Nigeria. You authorise these transfers, which are necessary to provide the service.
9.2We rely on the data protection commitments in our agreements with each sub-processor to ensure Customer Personal Data remains protected to the standard Data Protection Law requires wherever it is processed.

10. Helping you meet your obligations

10.1Requests from people. SME360 gives you the tools to answer requests from your customers, suppliers and staff yourself: you can find, correct and delete their records in the app, and download everything in your business from Settings → Your data.
10.2If we receive a request directly from someone whose data is in your business, we will not answer it ourselves (unless the law requires us to); we will pass it to you without undue delay and help you respond.
10.3We will give you reasonable information and help with any data protection impact assessment or consultation with the Nigeria Data Protection Commission that relates to your use of SME360.

11. Personal data breaches

11.1If we become aware of a personal data breach affecting Customer Personal Data, we will notify the account owner without undue delay and in any event within 48 hours, so that you can meet your own duty to notify the Nigeria Data Protection Commission within 72 hours where it applies.
11.2Our notice will describe, as far as we know at the time, what happened, the types and approximate amount of data and people affected, the likely consequences, and what we have done or propose to do about it. We will send further information as we learn it.
11.3We will take reasonable steps to contain the breach and reduce its effects, and cooperate with you in responding to it.

12. Deletion and return of data

12.1You can download all Customer Personal Data in your business at any time from Settings → Your data, in Excel, CSV and PDF formats, together with your uploaded files.
12.2When you delete your business in Settings, its records, uploaded files and messages are removed from the live service immediately, and sign-ins you created for staff are closed.
12.3Deleted data remains in our encrypted backups until those backups are deleted, which happens within 30 days. We restore from backups only to recover from a disaster, never to bring back data you deleted.
12.4We keep a record that a business was deleted, with no identifying details, and anonymous usage totals for our own accounting. We may keep other data only where the law requires us to.

13. Information and audits

13.1On reasonable request, we will give you the information you need to demonstrate that we comply with this DPA, for example by answering a written security questionnaire once a year.
13.2If Data Protection Law or a regulator requires an audit, we will cooperate with a reasonable audit on reasonable notice, carried out in a way that protects other customers' data and our security. Audits of our sub-processors are met with the reports and certifications they make available.

14. Duration, liability and law

14.1This DPA lasts for as long as we process Customer Personal Data for you, and ends once that data has been deleted as described in section 12.
14.2Each party's liability under this DPA is subject to the limitations and exclusions in the Terms of Service, except where Data Protection Law does not allow liability to be limited.
14.3This DPA is governed by the laws of the Federal Republic of Nigeria, and the courts of Nigeria have jurisdiction.
14.4We may update this DPA to reflect changes in the law or in SME360. We will update the date at the top and tell account owners about any significant change before it takes effect.

Annex 1 — Details of the processing

Subject matter	Providing SME360, a business record-keeping service with an AI assistant, to the Business.
Duration	For as long as the Business uses SME360, and until deletion under section 12.
Nature of processing	Storing, organising, displaying, searching, calculating with, generating documents from, emailing, sharing by link, sending to the AI provider to answer the Business's requests, reading uploaded documents, backing up and deleting.
Purpose	To let the Business record sales, expenses, invoices, receipts, orders, payments, staff pay and tasks; keep customer, supplier and staff details; store documents; and use the assistant on the web and on WhatsApp.
Data subjects	The Business's customers, suppliers, staff and contractors; people named in documents, photos and messages the Business uploads or sends; recipients of documents the Business emails or shares.
Types of personal data	Names; phone numbers; email and postal addresses; tax and company registration numbers; bank account details; amounts bought, sold, owed and paid; order and delivery details; staff roles, permissions, pay rates, payments and advances; notes the Business writes; the contents of uploaded documents and photos; messages to the assistant that mention people.
Sensitive data	Not intended. See section 5.3.

Annex 2 — Security measures

Encryption in transit — all traffic to SME360 uses HTTPS.
Access control — every request is authenticated, and checked on our servers against the user's membership of the business and their role and permissions. A business can only ever read its own records; references to other records are checked to belong to the same business before they are saved.
Least privilege for the Business's own team — owners decide what each staff member can see and do; costs, margins and staff pay are hidden from staff who are not allowed to see them.
Private file storage — uploaded files are never public; they are served only after a permission check or through a short-lived signed link.
Passwords — handled by our sign-in provider and stored hashed; never visible to SME360.
Share links — generated from 128 bits of randomness so they cannot be guessed, created only when the Business shares a document, and can be switched off at any time.
Backups — taken nightly, encrypted with AES-256 before they leave our servers, kept in separate secure locations, and deleted after 30 days.
Internal access — limited to named team members by configuration, separated into tiers, and every access to internal tools is logged.
Abuse protection — rate limits on the service, stricter limits on the AI assistant, and signature verification on messages arriving from WhatsApp.
AI safeguards — the assistant cannot save anything involving money without the user confirming it; it is never trusted to decide who may access what, or to pick which record to change (our servers look records up within the business itself); and it is tested against attempts to hide instructions inside notes and documents.
Deletion — deleting a business removes its records, files and messages from the live service, and closes staff sign-ins created for it.

Annex 3 — Sub-processors

Sub-processor	Purpose	Customer Personal Data it handles	Location
Railway	Hosting the application and database	All stored records	United States
Cloudflare	File storage and network protection	Uploaded files and documents; network traffic	United States / global network
Anthropic	AI assistant and reading uploaded documents	Requests to the assistant and the related records sent with them; uploaded documents	United States
Clerk	Sign-in for the Business's staff	Staff names and sign-in addresses	United States
Resend	Email delivery	Invoices and receipts the Business emails, and the recipient's address	United States
Meta (WhatsApp Business Platform)	The WhatsApp assistant	Messages exchanged with the Business's linked numbers	Global
Formspree	In-app feedback form	Only what a user chooses to write in feedback	United States
Hostinger	Our email inbox	Only what is emailed to us, for example a support request	Global

Contact

Questions about this DPA, or a request for a signed copy: info@sme360app.com.
Bleu Meridian Technologies (CAC no. 9017064), Lagos, Nigeria.